CVE-2025-65559

Executive Summary

CVE-2025-65559 is a denial-of-service (DoS) vulnerability in the Open5GS User Plane Function (UPF) component, version 2.7.5-49-g465e90f. The flaw resides in the PFCP (Packet Forwarding Control Protocol) session establishment logic. By sending a crafted PFCP Session Establishment Request (type=50) where the Create PDR (Packet Detection Rule) PDI (Packet Detection Information) F-TEID (Fully Qualified Tunnel Endpoint Identifier) has the CH (Choose) flag set to 1, and the F-TEID address-family flags (IPv4/IPv6) do not match the GTP-U resource family configured for the selected DNN (Data Network Name), an attacker can trigger a reachable assertion in lib/pfcp/context.c within the ogs_pfcp_object_teid_hash_set function. This causes the UPF process to crash, resulting in a denial of service for all subscribers served by that UPF.

The vulnerability is unpatched as of the latest available information. No public proof-of-concept (PoC) or exploit code has been released. The CVSS v3.1 base score is 7.5 (High) due to network attack vector, low attack complexity, no privileges required, and no user interaction, with high availability impact.

Supply Chain & Package Security

Open5GS is an open-source 5G Core network implementation written in C. It is distributed via GitHub and can be compiled from source or installed via package managers (e.g., apt, yum) from third-party repositories. The vulnerability affects the core PFCP stack, which is a critical component for 5G control/user plane separation. Organizations using Open5GS in production or lab environments should treat this as a high-severity supply chain risk, as the vulnerable code is part of the standard distribution. No official patch or updated package has been released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the N4 interface (PFCP) between the SMF and UPF.
• Attack Complexity (AC): Low (L) – No special conditions are required; a single crafted packet suffices.
• Privileges Required (PR): None (N) – The attacker does not need any authentication or prior access.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The UPF crashes, causing complete loss of service.

Threat Level: High (7.5). The vulnerability is easily exploitable remotely and leads to a complete denial of service for the UPF, affecting all connected UEs.

Deep Dive & Mechanics

The PFCP protocol is used between the Session Management Function (SMF) and the User Plane Function (UPF) in 5G core networks. During PFCP Session Establishment, the SMF sends a PFCP Session Establishment Request (message type 50) containing one or more Packet Detection Rules (PDRs). Each PDR includes a PDI (Packet Detection Information) which may contain an F-TEID (Fully Qualified Tunnel Endpoint Identifier) that identifies the GTP-U tunnel endpoint.

The F-TEID has a CH (Choose) flag. When CH=1, the UPF is instructed to automatically allocate the F-TEID (IP address and TEID) for the GTP-U tunnel. The UPF must then select an IP address from its configured GTP-U resources for the given DNN (Data Network Name). The F-TEID also contains address-family flags indicating whether IPv4, IPv6, or both are required.

The vulnerability occurs in the ogs_pfcp_object_teid_hash_set function in lib/pfcp/context.c. When the UPF processes a PFCP Session Establishment Request with CH=1, it attempts to hash the TEID into a hash table. However, if the address-family flags in the F-TEID (e.g., IPv4 only) do not match the GTP-U resource family configured for the selected DNN (e.g., IPv6 only), the function hits a reachable assertion (ogs_assert) that crashes the UPF process.

The assertion is likely placed to catch programming errors, but it is reachable by an external attacker sending a crafted PFCP message. This makes it a classic reachable assertion vulnerability (CWE-617).

Vulnerable vs. Patched Code

The vulnerable code is in lib/pfcp/context.c in the ogs_pfcp_object_teid_hash_set function. The exact vulnerable lines are not publicly available, but the assertion is triggered when the address-family mismatch occurs.

Vulnerable code (conceptual):

void ogs_pfcp_object_teid_hash_set(ogs_pfcp_object_t *object, ...) {
    // ... some logic ...
    if (ch_flag) {
        // Select GTP-U resource based on DNN
        // ...
        // Assert that the selected resource matches the requested address family
        ogs_assert(selected_resource->addr_family == requested_addr_family);
        // ... hash the TEID ...
    }
}

Patched code (hypothetical):

void ogs_pfcp_object_teid_hash_set(ogs_pfcp_object_t *object, ...) {
    // ... some logic ...
    if (ch_flag) {
        // Select GTP-U resource based on DNN
        // ...
        // Gracefully handle mismatch instead of asserting
        if (selected_resource->addr_family != requested_addr_family) {
            // Log error and return failure
            ogs_error("Address family mismatch for DNN %s", dnn);
            return OGS_ERROR;
        }
        // ... hash the TEID ...
    }
}

The fix should replace the ogs_assert with proper error handling that returns an error code to the SMF via a PFCP Session Establishment Response with an appropriate cause value.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to the N4 interface (PFCP port 8805) of a vulnerable Open5GS UPF.
• Ability to craft raw PFCP packets (e.g., using Scapy, custom C code, or a PFCP fuzzer).

Exploitation Steps:

1. Identify Target: Scan for Open5GS UPF instances listening on UDP port 8805.
2. Craft Malicious PFCP Session Establishment Request:
   • Set message type = 50 (PFCP Session Establishment Request).
   • Include a Create PDR IE with a PDI IE containing an F-TEID IE.
   • Set the CH flag in the F-TEID to 1.
   • Set the address-family flags to a value that does not match the configured GTP-U resource for the target DNN (e.g., IPv4 only when the UPF has only IPv6 resources).
3. Send Packet: Send the crafted packet to the UPF's PFCP endpoint.
4. Observe Crash: The UPF process will crash due to the reachable assertion, causing a denial of service.

Example Scapy script (conceptual):

from scapy.all import *
from scapy.contrib.pfcp import *

# Build PFCP Session Establishment Request
pdr = PFCPCreatePDR(
    pdr_id=1,
    pdi=PFCPPDI(
        f_teid=PFCPFTEID(
            ch=1,
            ipv4=1,  # Request IPv4 only
            ipv6=0,
            teid=0,
            ipv4_addr="0.0.0.0"
        )
    )
)

req = PFCP(
    version=1,
    msg_type=50,
    seid=0,
    seq_num=1,
    ies=[pdr]
)

send(req, iface="eth0")

Blue Team

Detection:

• Monitor PFCP Session Establishment Requests for anomalous F-TEID configurations (CH=1 with mismatched address families).
• Use the Suricata rule provided in the Detection Engineering section to alert on such packets.
• Monitor UPF process crashes and correlate with PFCP traffic.

Mitigation:

• Apply the vendor patch when available.
• If patching is not possible, implement network-level filtering to restrict PFCP traffic to trusted SMF IP addresses only.
• Use a Web Application Firewall (WAF) or IPS that can inspect PFCP messages (if supported).
• Consider running the UPF in a container with resource limits and auto-restart policies to minimize downtime.

Indicators of Compromise (IOCs)

• Network IOCs:

  • PFCP Session Establishment Request (type 50) with F-TEID CH flag set to 1 and address-family flags not matching the DNN's GTP-U resource.
  • Source IP addresses of the attacking SMF (if known).
  • UDP packets to port 8805 with anomalous PFCP message structures.

• System IOCs:

  • UPF process crash logs containing the assertion failure message: ogs_pfcp_object_teid_hash_set assertion failed.
  • Core dump files from the UPF process.
  • Sudden termination of the upf process.

• Log IOCs:

  • Open5GS UPF logs showing ogs_assert failures in lib/pfcp/context.c.
  • System logs (e.g., /var/log/syslog) showing UPF service restarts.

Detection Engineering

YARA Rule

rule CVE_2025_65559_PFCP_DoS {
    meta:
        description = "Detects PFCP Session Establishment Request with mismatched F-TEID address family (CVE-2025-65559)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65559"
        hash = "unknown"
    strings:
        $pfcp_type = { 32 } // PFCP Session Establishment Request (type 50 = 0x32)
        $f_teid_ch = { 00 01 } // F-TEID with CH=1 (assuming CH is bit 0 of first byte)
        $ipv4_only = { 01 } // IPv4 flag set, IPv6 not set
        $ipv6_only = { 02 } // IPv6 flag set, IPv4 not set
    condition:
        $pfcp_type and $f_teid_ch and ($ipv4_only or $ipv6_only)
}

Sigma Rule

title: CVE-2025-65559 - Open5GS UPF PFCP DoS via Mismatched F-TEID
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects PFCP Session Establishment Requests with CH=1 and mismatched address family flags targeting Open5GS UPF.
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65559
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 202565559
    condition: selection
falsepositives:
    - Legitimate PFCP messages with CH=1 and matching address families
level: high

Suricata Rule

alert udp any any -> any 8805 (msg:"CVE-2025-65559 - Open5GS UPF PFCP DoS Attempt"; content:"|20 32|"; depth:2; content:"|00 01|"; within:20; content:"|01|"; within:2; sid:202565559; rev:1; reference:cve,2025-65559;)

Remediation & Mitigation

Immediate Actions:

1. Isolate UPF: Restrict network access to the N4 interface (UDP 8805) to only trusted SMF IP addresses using firewall rules.
2. Monitor: Enable detailed logging for PFCP messages and monitor for anomalous F-TEID configurations.
3. Workaround: If possible, configure the UPF to reject PFCP Session Establishment Requests with CH=1 and mismatched address families by modifying the source code (if you have the ability to compile custom builds).

Long-term Fix:

• Apply the official patch from Open5GS when released. The fix should replace the ogs_assert with proper error handling.
• Upgrade to a patched version of Open5GS once available.

Compensating Controls:

• Deploy an intrusion prevention system (IPS) capable of inspecting PFCP traffic (e.g., Suricata with the provided rule).
• Implement rate limiting on PFCP messages to reduce the impact of DoS attacks.
• Use container orchestration (e.g., Kubernetes) with liveness probes to automatically restart crashed UPF instances.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2025-65559